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Abstract We present several generalizations of results for splitting authentication 
codes by studying the aspect of multi-fold security. As the two primary results, we 
prove a combinatorial lower bound on the number of encoding rules and a combinato- 
rial characterization of optimal splitting authentication codes that are multi-fold secure 
against spoofing attacks. The characterization is based on a new type of combinato- 
rial designs, which we introduce and for which basic necessary conditions are given 
regarding their existence. 
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1 Introduction 

Authenticity is one of the fundamental components in cryptography and information 
security. Typically, communicating parties would like to be assured of the authenticity 
of information they obtain via potentially insecure channels. Concerning unconditional 
(theoretical) authenticity, authentication codes can be used to minimize the possi- 
bility of an undetected deception. Their initial study appears to be that of Gilbert, 
Mac Williams & Sloane [9]. A more general and systematic theory of authenticity was 
developed by Simmons [22,23]. 

We primarily focus on authentication codes with splitting in this paper. In such 
a code, several messages can be used to communicate a particular plaintext [non- 
deterministic encoding). This concept plays an important role, for instance, in the con- 
text of authentication codes that permit arbitration (see, for example, [13-15,24,25]). 
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We will deal with splitting authentication codes from a combinatorial point of view. 
By studying the aspect of multi-fold security, we obtain several natural generalizations 
of results on splitting authentication codes. As the two primary results, we prove a 
combinatorial lower bound on the number of encoding rules and a combinatorial char- 
acterization of optimal splitting authentication codes that are multi-fold secure against 
spoofing attacks. 

For splitting authentication codes that are one-fold secure against spoofing at- 
tacks, Brickell [3] and Simmons [25] have established a combinatorial lower bound on 
the number of encoding rules. We will give a combinatorial lower bound accordingly for 
multi-fold secure splitting authentication codes. Ogata et al. [17] introduced splitting 
balanced incomplete block designs (BIBDs). They proved basic necessary conditions 
for their existence and derived a Fisher-type inequality. Furthermore, they established 
an equivalence between splitting BIBDs and optimal one-fold secure splitting authen- 
tication codes. We will extend the notion of splitting BIBDs to splitting t-designs. 
Comprehensive necessary conditions regarding their existence will be given. Moreover, 
we will prove an equivalence between splitting t-designs and optimal (t — l)-fold secure 
splitting authentication codes. 

The paper is organized as follows. In Section 2, we give the definition and concept 
of multi-fold secure splitting authentication codes. We introduce splitting designs and 
prove basic necessary conditions for their existence in Section 3. With respect to our 
further purposes, we summarize in Section 4 the state-of-the-art for authentication 
codes without splitting. In Section 5, lower bounds on deception probabilities and the 
number of encoding rules are established for multi-fold secure splitting authentication 
codes. A combinatorial characterization of optimal multi-fold secure splitting authen- 
tication codes in terms of splitting designs is given in Section 6. We finally conclude 
the paper and propose further research problems in Section 7. 

2 Splitting Authentication Codes 

Splitting authentication codes were first introduced by Simmons [21]. These codes are 
useful, inter alia, for the analysis of authentication codes with arbitration. In particu- 
lar, [15] gives an equivalence between splitting authentication codes and authentication 
codes with arbitration. 

We use the unconditional (theoretical) secure authentication model developed by 
Simmons (e.g. [21-23,26]). Our notation follows, for the most part, that of [16,17,27]. 
In this model, three participants are involved: a transmitter, a receiver, and an oppo- 
nent. The transmitter wants to communicate information to the receiver via a public 
communications channel. The receiver in return would like to be confident that any 
received information actually came from the transmitter and not from some opponent 
{integrity of information). The transmitter and the receiver are assumed to trust each 
other. Sometimes this is also called an A-code. 

Let S denote a finite set of source states (or plaintexts), Ai a finite set of messages 
(or ciphertexts), and £ a finite set of encoding rules (or keys). Using an encoding rule 
e £ £, the transmitter encrypts a source state s £ 5 to obtain the message m = e(s) 
to be sent over the channel. The encoding rule is communicated to the receiver via a 
secure channel prior to any messages being sent. When it is possible that more than 
one message can be used to communicate a particular source state s £ S under the 
same encoding rule e £ £, then the authentication code is said to have splitting. In this 
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Table 1 An example of a splitting authentication code. 





Si 


S2 


ei 


{mi, 7712} 


{ms.ms} 


62 


{m.2, ms} 


{m4,m6} 


63 


{ms, 7714} 


{m5,m7} 


64 


{m4,m5} 


{mgjmg} 


65 




{m7,m9} 


66 


{mg, m7} 


{m8,mi} 


67 


{mT,ms} 


{m9,m2} 


68 


{mg.mg} 


{mi.ms} 


69 


{mg, mi} 


{1712,1714} 



case, a message m £ TVf is computed as m = e(s, r), where r denotes a random number 
chosen from some specified finite set TZ. If we define 

e(s) :— {m £ M :m = e{s,r) for some r G TZ} 

for each encoding rule e £ £ and each source state s £ S, then splitting means that 
|e(s)| > 1 for some e £ £ and some s £ 5. In order to ensure that the receiver can 
decrypt the message being sent, it is required for any e £ £ that e(s) n e(s') = if 
s 7^ s'. For a given encoding rule e £ £, let 

M(e) := (J e(s) 

denote the set of valid messages. For an encoding rule e and a set M' C M(e) of 
distinct messages, we define 

/e(M') := {sG5:e(s)nA/'/0}, 

i.e., the set of source states that will be encoded under encoding rule e by a message 
in M' . A received message m will be accepted by the receiver as being authentic if 
and only if ?n £ M{e). When this is fulfilled, the receiver decrypts the message m by 
applying the decoding rule e~^, where 

e^^(m) = s if m = e(s,r) for some r £ TZ. 

A splitting authentication code is called c-splitting if 

|e(s)| = c 

for every encoding rule e £ £ and every source state s £ S. We note that an authenti- 
cation code can be represented algebraically by a {\£\ x \S\)-encodmg matrix with the 
rows indexed by the encoding rules e £ £, the columns indexed by the source states 
s £ S, and the entries defined by aes := e(s). As a simple example. Table 1 displays 
an encoding matrix of a 2-splitting authentication code for 2 source states, having 9 
messages and 9 encoding rules (cf. Example 3). 
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2.1 Protection Against Spoofing Attacks 

We address the scenario of a spoofing attack of order i (cf. [16]): Suppose tfiat an oppo- 
nent observes i > distinct messages, wiiicii are sent tlirough tlie public channel using 
the same encoding rule. The opponent then inserts a new message m' (being distinct 
from the i messages already sent), hoping to have it accepted by the receiver as authen- 
tic. The cases i — and i = 1 are called impersonation game and substitution game, 
respectively. These cases have been studied in detail in recent years for authentication 
codes without splitting (see, e.g., [28,29]) and with splitting (see, e.g., [2,6,17]). How- 
ever, much less is known for the cases i > 2 in particular for splitting authentication 
codes. 

For any i, we assume that there is some probability distribution on the set of 
i-subsets of source states, so that any set of i source states has a non-zero probability 
of occurring. For simplification, we ignore the order in which the i source states oc- 
cur, and assume that no source state occurs more than once. Given this probability 
distribution on the set S of source states, the receiver and transmitter also choose a 
probability distribution on the set £ of encoding rules, called an encoding strategy. 
It is assumed that the opponent knows the encoding strategy being used. If splitting 
occurs, then the receiver/transmitter will also choose a splitting strategy to determine 
m £ Ai, given s G 5 and e £ £ (this corresponds to non- deterministic encoding). The 
transmitter/receiver will determine these strategies to minimize the chance of being 
deceived by the opponent. The deception probability P^. denotes the probability that 
the opponent can deceive the transmitter/receiver with a spoofing attack of order i. 

3 Splitting Designs 

There are natural and deep connections between authentication codes and combinato- 
rial designs, see, for example, [4,10,17,18,27-29]. The close relationship between cryp- 
tography and designs was presumably first revealed in Shannon's classical paper [20] 
on secrecy systems. 

In order to give a combinatorial characterization of multi-fold secure splitting au- 
thentication codes in the remainder of the paper, we define in this section a new type of 
combinatorial designs. Let us first recall the classical notion of a combinatorial t-design 
(see, for instance, [1]): 

Definition 1 For positive integers t < k < v and A, a t-{v, k, A) design 2? is a pair 
{X, B) , satisfying the following properties: 

(i) X is a. set of v elements, called points, 

(ii) B is a family of fc-subsets of X, called blocks, 

(iii) every f-subset of X is contained in exactly A blocks. 

By convention, b := \B\ denotes the number of blocks. It is easily seen that 



For encyclopedic references on combinatorial t-designs, we refer to [1,4]. A recent 
treatment on highly regular designs and their applications in information and coding 
theory can be found, e.g., in [11,12]. 
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The notion of a splitting balanced incomplete block design (BIBD) have been in- 
troduced by Ogata et al. [17]. We will extend this concept to splitting t-designs: 

Definition 2 For positive integers t, v, b, c, u, X with t < u and cu < v, a t-{v, b, I = cu, A) 
splitting design © is a pair [X,B), satisfying the following properties: 

(i) X is a set of v elements, called points, 

(ii) B is a family of /-subsets of X, called blocks, such that every block Bi £ B {1 < i < 
\B\ —: b) is expressed as a disjoint union 

Bi = Bi i U • ■ • U Bi T^ 

with I -Bi.i I = ■ ■ • = |-Bi,u I = c and \Bi\ — I — cu, 

(iii) every t-subset {x-m}m=iof X is contained in exactly A blocks Bi = Bi i U ■ • - UBi^u 
such that 

Xm & Bi j^ {jm between 1 and it) 
for each 1 < m < t, and ji, . ■ ■ ,jt are mutually distinct. 

Example 1 A splitting 2-design is a splitting BIBD. As a simple example, take as point 
set 

X = {1,2, 3, 4, 5, 6, 7, 8, 9} 

and as block set 



B = 


--{Bi,.. 




Bi = 


{{1,2}, 


{3,5}} 


B2 = 


{{2,3}, 


{4,6}} 


B3 = 


{{3,4}, 


{5,7}} 


B4 = 


{{4,5}, 


{6,8}} 


B5 = 


{{5,6}, 


{7,9}} 


Be = 


{{6,7}, {8,1}} 


B7 = 


{{7,8}, {9,2}} 


Bs = 


{{8,9}, 


{1,3}} 


Bg = 


{{9,1}, 


{2,4}} 



This gives a 2-(9,9,4 = 2 x 2, 1) splitting design (see [17, Ex. 5.1]). 

Example 2 A 3-(10, 15, 6 = 2 x 3, 1) splitting design can be obtained (via a computer 
search) by taking as point set 

X = {1,2, 3, 4, 5, 6, 7, 8, 9,0} 



and as block set 



B={Bi,...,Bi5} 



6 



with 



ID 

Bi 


- 111^ ^1. 


{4, Uj, io,9|| 


JD 




fo cl fc: nil 


JD 

^3 


f f 1 A\ 


fQ cl nil 


TD 


f ri c^i 
= Ul.oj, 


r /I 7l f Ql 1 

{4, 7j, |6,8}} 


TD 




To Ql f/1 Qll 

{2,3}, |4,8}} 




- 111. o|. 


fo f^^ nil 
i^, 0}, {0,9}} 


±Sj 


- 111. o|. 


r 7l fn nl 1 
{0, 7j, |9, U|| 


Bs 


= {{1.9}, 


{2,5}, {3,7}} 


B9 


= {{1,9}, 


{3,4}, {7,0}} 


Bio 


= {{2,4}, 


{5,6}, {7,9}} 


Bii 


= {{2,5}, 


{4,7}, {3,0}} 


B12 


= {{2,9}, 


{6,8}, {3,0}} 


Biz 


= {{2,0}, 


{4,5}, {6,8}} 


Bi4 


= {{3,7}, 


{4,6}, {8,0}} 


B15 


= {{3, 9}, 


{5,7}, {6,0}} 



We prove some basic necessary conditions for the existence of sphtting designs: 

Proposition 1 Let T> = (X, B) be a t-{v, b, I — cu, A) splitting design, and for a posi- 
tive integer s < t, let S ^ X with \S\ = s. Then the number of blocks containing each 
element of S as per Definition 2 is given by 



In particular, for t > 2, a t-{v, b,l = cu, A) splitting design is also an s-{v, b, I = cu. As) 
splitting design. 

Proof We count in two ways the number of pairs (T, Bi), where T :— {^m}m=i C X 
and Bi = Uj^i Bij £ 13 such that 



for each 1 < m < t with ji, ■ ■ ■ ,jt mutuaUy distinct, and S :— {im}m=l — ^- First, 



for each 1 < m < s with ji, . . . , js mutually distinct gives 



each of the As blocks Bi = Uj=i Bij such that 

S^m £ Bi j^ 



{t-s)\ 




such pairs. Second, there are 




such subsets T C X with S ^^T, each giving A pairs by Definition 2. 



n 
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As it is customary for i-designs, we also set r :— Ai denoting the number of blocks 
containing a given point. The above elementary counting arguments give the following 
assertions. 

Proposition 2 Let D = {X, B) be a t-{v, b, I = cu, A) splitting design. Then the fol- 
lowing holds: 



(a) bl — vr. 




(c) rc*"l(u - 1) = A2(d - 1) /or t > 2. 

Remark 1 The above proposition extends the result [17, Lemma 5.1], where (b) and 
(c) have been proved for the case when t = 2. 

Since in Proposition 1 each Xs must be an integer, we obtain furthermore the 
subsequent necessary arithmetic conditions. 

Proposition 3 Let V = {X,B) be a t-{v,b,l = cu, A) splitting design. Then 




for each positive integer s < t. 

Ogata et al. [17] proved a Fisher-type inequality for splitting BIBDs. As a splitting 
t-design with t > 2 is also a splitting 2-design in view of Lemma 1 , we derive 

Proposition AIfT> = {X, B) is a t-{v, b, I = cu, A) splitting design with t > 2, then 



4 Authentication Codes without Sphtting 

With respect to our further purposes, we summarize the state-of-the-art for authenti- 
cation codes without splitting: 

The following theorems (cf. [16, 19]) give combinatorial lower bounds on cheating 
probabilities as well as on the size of encoding rules for multi-fold secure authentication 
codes: 

Theorem 1 (Massey) In an authentication code without splitting, for every < i < 
t, the deception probabilities are bounded below by 



\M\-i 

We remark that a code is called t-fold secure against spoofing if 
Pd^ = {\S\~i)/{\M\~i) 

for all < i < t. 
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Theorem 2 (Massey— Schobi) If an authentication code without splitting is {t — l)-fold 
secure against spoofing, then the number of encoding rules is bounded below by 

\£\ > ^ * ' 

Such a code is called optimal if the number of encoding rules meets the lower bound 
with equality. When the source states are known to be independent and equiproba- 
ble, optimal authentication codes without splitting which are multi-fold secure against 
spoofing have been characterized via t-designs (cf. [5, 19,27]). 

Theorem 3 (DeSoete— Schobi— Stinson) Suppose there is a t-(v, k, A) design. Then 
there is an authentication code without splitting for k equiprobable source states, having 
V messages and A(j)/(() encoding rules, that is {t — l)-fold secure against spoofing. 
Conversely, if there is an optimal authentication code without splitting for k equiprob- 
able source states, having v messages and encoding rules, that is (t — l)-fold 
secure against spoofing, then there is a t-{v, k, 1) design. 

Combinatorial constructions of optimal multi-fold secure authentication codes with- 
out splitting which simultaneously achieve perfect secrecy have been obtained recently 
via the following theorem (see [10]). 

Theorem 4 (Huber) Suppose there is a t-{v, k, 1) design, where v divides the number 
of blocks b. Then there is an optimal authentication code without splitting for k equiprob- 
able source states, having v messages and encoding rules, that is {t — l)-fold 
secure against spoofing and provides perfect secrecy. 



5 Combinatorial Bounds for Splitting Authentication Codes 

In this section, we give combinatorial lower bounds on deception probabilities, and a 
combinatorial lower bound on the size of encoding rules for splitting authentication 
codes that are multi-fold secure against spoofing. 

We first state lower bounds on cheating probabilities for splitting authentication 
codes (see [2,6]). 

Theorem 5 (DeSoete— Blundo—DeSantis— Kurosawa— Ogata) In a splitting au- 
thentication code, for every < i < t, the deception probabilities are bounded below 
by 

P l^(e)|-«-max,g5|e(s) 
. ^ mm ■ 



eef \M\-i 
A splitting authentication code is called t-fold secure against spoofing if 

|A/(e)| - i ■ maxsgs |e(s)| 



P(j. = min ■ , , ^ 

* ee£ \M\ 



for all < i < t. 



We prove now a lower bound on the size of encoding rules for multi-fold secure 
splitting authentication codes. 
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Theorem 6 If a splitting authentication code is {t — l)-fold secure against spoo_ 
then the number of encoding rules is bounded below by 



jM(e)| - i ■ inaxses |e(s)j ' 

i — u 

Proof Let A/' C yVI be a set of i < f — 1 distinct messages that are valid under a 
particular encoding rule, in such a way that they define i difTerent source states. Let 
X £ M he any message not in M' . We assume that there is no encoding rule e £ £ 
under which all messages in M'u{x} are valid and for which fe{x) ^ fe{M'). Following 
the proof of Theorem 5, mutatis mutandis, yields 

p . ■ |M(e)|-i-maxsgg|e(s) 
Jr^^ > mm 7—— ■ , 

a contradiction. Therefore, any set of t distinct messages is valid under at least one 
encoding rule such that they define different source states. The bound follows now by 
counting in two ways the number of f-subsets of messages that are valid under some 
encoding rule such that they correspond to different source states. □ 

Analogously, we call a splitting authentication code optimal if the number of en- 
coding rules meets the lower bound with equality. 

Remark 2 The above theorem generalizes results by Brickell [3] and Simmons [25], 
where a lower bound in the case of one-fold secure splitting authentication codes has 
been established. 

As a consequence, we obtain for c-splitting authentication codes the following lower 
bounds: 

Corollary 1 In a c-splitting authentication code, 

c{\S\-i) 



\M\-i 
for every < i < t. 

Proof We set I ■- |M(e)| = c Then Theorem 5 yields 

> l~i-c ^ c{\S\ -i) 
'^^ - \M\-i \M\-i ' 



Corollary 2 If a c-splitting authentication code is (t — l)-fold secure against spoofing, 
then 

(\M\\ 
\£\> ^ ' > 



c*(lfl) 



Proof Using Theorem 6, we may proceed as for Corollary 1. 
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Table 2 Splitting authentication code from a 2-(9,9,4 = 2 X 2, 1) splitting design. 





Si 


S2 


ei 


{1,2} 


{3,5} 


62 


{2,3} 


{4,6} 


63 


{3,4} 


{5,7} 


64 


{4,5} 


{6,8} 


65 


{5,6} 


{7,9} 


66 


{6,7} 


{8,1} 


67 


{7,8} 


{9,2} 


68 


{8,9} 


{1,3} 


69 


{9,1} 


{2,4} 



6 Combinatorial Characterizations of Optimal Splitting Authentication 
Codes 

Ogata et al. [17, Thms. 5.4 and 5.5] characterized in 2004 optimal splitting authenti- 
cation codes that are one-fold secure against spoofing. Their combinatorial result is 
based on splitting BIBDs. 

Theorem 7 (Ogata— Kurosawa— Stinson—Saido) Suppose there is a 2-{v, b, I = cu, 1) 
splitting design. Then there is an optimal c-splitting authentication code for u equiprob- 
able source states, having v messages and (2)/ [2^(2)! encoding rules, that is one-fold 
secure against spoofing. Conversely, if there is an optimal c-splitting authentication code 
for u source states, having v messages and (2)/['^^(2)] encoding rules, that is one-fold 
secure against spoofing, then there is a 2-{v, b, I = cu, 1) splitting design. 

An example is as follows (cf. [17, Ex. 5.2]): 

Example 3 An optimal 2-splitting authentication code for u — 2 equiprobable source 
states, having v = 9 messages and 6 = 9 encoding rules, that is one-fold secure against 
spoofing can be constructed from the 2-(9, 9, 4 = 2 x 2, 1) splitting design in Example 1. 
Each encoding rule is used with probability 1/9. An encoding matrix is given in Table 2. 

We give a natural extension of Theorem 7. We prove that optimal splitting authen- 
tication codes that are multi-fold secure against spoofing can be characterized in terms 
of splitting t-designs. 

Theorem 8 Suppose there is a t-{v, b, I = cu, 1) splitting design with t > 2. Then there 
is an optimal c-splitting authentication code for u equiprobable source states, having v 
messages and (t)/[c*(")] encoding rules, that is (t — l)-fold secure against spoofing. 
Conversely, if there is an optimal c-splitting authentication code for u source states, 
having v messages and (t)/[c*(^)] encoding rules, that is {t — l)-fold secure against 
spoofing, then there is a t-(v,b,l — cu, 1) splitting design. 

Proof Let us first assume that there is an optimal c-splitting authentication code for 
|<S| := u source states, having |A^| :— v messages and \£\ :— (")/[c*(")] encoding 
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rules, that is {t — l)-fold secure against spoofing. In order to meet the lower bound in 
Theorem 6 with equality, every set of t distinct messages must be valid under precisely 
one encoding rule, in such a way that they define diiTerent source states. For e £ £, let 
us define a block Be £ B as disjoint union 

u 

Be ~ y e(s^). 

Then {X,B) — (A4,{Be : e G £}) is a t-{v,b,l = cu,l) splitting design in view of 
Definition 2. 

To prove the other direction, let \Ai\ := v. For every block B^ £ B with 

u 

we arbitrarily define an encoding rule eg. via 

eB,{sj) ■■= Bij 

for each 1 < j < u. Using every encoding rule with equal probability 1/6 establishes 
the claim. □ 

We present an example: 

Example 4 An optimal 2-splitting authentication code for u = 3 equiprobable source 
states, having v = 10 messages and 6 = 15 encoding rules, that is two-fold secure 
against spoofing can be constructed from the 3-(10, 15, 6 = 2 x 3, 1) splitting design in 
Example 2. Each encoding rule is used with probability 1/15. An encoding matrix is 
given in Table 3. 



7 Conclusion 

We have given a combinatorial lower bound on the number of encoding rules for split- 
ting authentication codes that are multi-fold secure against spoofing attacks. Moreover, 
we have provided a combinatorial characterization of those codes that attain these 
bounds. Our characterization was based on a new type of combinatorial designs, which 
we introduced and for which basic necessary conditions regarding their existence were 
given. For future research, at least two directions would be of interest: 

(i) Construction of multi-fold secure splitting authentication codes: Using Theorem 8, 
this asks for constructing t-{v,b,l = cu, 1) splitting design for t > 2. We remark 
that in the case when t = 2, various combinatorial constructions have been ob- 
tained recently in [7, 8, 30] via recursive and direct constructions by the method of 
differences. 

(ii) Including the aspect of perfect secrecy: Is it possible to give a characterization of 
optimal splitting authentication codes that are multi-fold secure against spoofing 
and simultaneously achieve perfect secrecy in the sense of Shannon? For the case 
of multi-fold secure authentication codes without splitting such a result has been 
established lately in [10] (cf. Theorem 4). 
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Table 3 Splitting authentication code from a 3-(10, 15, 6 = 2 X 3, 1) splitting design. 







S2 


S3 


ei 


{1,2} 


{4,0} 


{5,9} 


62 


{1,3} 


{2,8} 


{5,0} 


63 


{1,4} 


{3,8} 


{6,9} 


64 


{1,5} 


{4,7} 


{6,8} 


65 


{1.7} 


{2,3} 


{4,8} 


66 


{1,8} 


{2,5} 


{6,9} 


67 


{1,8} 


{6,7} 


{9,0} 


68 


{1,9} 


{2,5} 


{3,7} 


69 


{1,9} 


{3,4} 


{7,0} 


eio 


{2,4} 


{5,6} 


{7,9} 


eii 


{2,5} 


{4,7} 


{3,0} 


ei2 


{2,9} 


{6,8} 


{3,0} 


ei3 


{2,0} 


{4,5} 


{6,8} 


ei4 


{3,7} 


{4,6} 


{8,0} 


ei5 


{3,9} 


{5,7} 


{6,0} 
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